Moderate Vulnerability in mingw-glib2: Integer Overflow in g_escape_uri_string()
Summary
ALSA-2026:18344: Moderate: mingw-glib2 security update. Affects mingw32-glib2 versions < 2.87.0-1.el10. Fixed in 2.87.0-1.el10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mingw-glib2 is a core library that provides essential building blocks for applications and libraries written in C. It is part of the GLib package, which includes a robust object system, main loop implementation, and various utility functions for handling strings and data structures. This library is widely used in GNOME applications and other software that relies on C programming. The vulnerability in question arises from an integer overflow in the g_escape_uri_string() function, which can lead to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-13601 is an integer overflow that occurs in the g_escape_uri_string() function of the GLib library. This flaw can be exploited by attackers to manipulate the URI strings processed by applications, potentially leading to unexpected behavior or security breaches. The ramifications of this vulnerability can be severe, as it may allow unauthorized access or execution of arbitrary code within affected applications, compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
2.87.0-1.el10
This is the first release that contains the fix.
sudo dnf update mingw32-glib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider avoiding the use of the g_escape_uri_string() function in your applications until the patch is applied. Review your code to identify any instances where this function is used and replace it with safer alternatives if possible.
Conclusion
The mingw-glib2 library has a moderate vulnerability due to an integer overflow in the g_escape_uri_string() function. It is crucial to update to the patched version 2.87.0-1.el10 to mitigate potential security risks. For those unable to update immediately, consider workarounds and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for mingw32-glib2 →
FAQ
CVE-2025-13601 is a security vulnerability in the GLib library that involves an integer overflow in the g_escape_uri_string() function.
Exploiting this vulnerability may allow attackers to manipulate URI strings, potentially leading to unauthorized access or execution of arbitrary code.
If an immediate update is not possible, avoid using the g_escape_uri_string() function and look for safer alternatives in your code.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
Related vulnerabilities
Recent vulnerabilities recorded for mingw32-glib2.
